- NANOG - lists.nanog.org

Low Cost 10G Router
by Colton Conor 21 May '15

21 May '15

What options are available for a small, low cost router that has at least four 10G ports, and can handle full BGP routes? All that I know of are the Juniper MX80, and the Brocade CER line. What does Cisco and others have that compete with these two? Any other vendors besides Juniper, Brocade, and Cisco to look at?

40 81

Re: Low Cost 10G Router
by Bryan Fields 21 May '15

21 May '15

On 5/19/15 1:22 PM, Colton Conor wrote: > What options are available for a small, low cost router that has at least > four 10G ports, and can handle full BGP routes? All that I know of are the > Juniper MX80, and the Brocade CER line. What does Cisco and others have > that compete with these two? Any other vendors besides Juniper, Brocade, > and Cisco to look at? In the same price range as the MX80 there is the Alcatel SRa-4/8 router. These will do 100g in and out, and handle full tables. You get redundant control modules vs. a single on the juniper. BGP is multi-threaded on the box, does RPKI for route verification, and it's got extensive HQoS functionality amongst other features. -- Bryan Fields 727-409-1194 - Voice 727-214-2508 - Fax http://bryanfields.net

2 1

AT&T/Telia issue
by Tyler Applebaum 20 May '15

20 May '15

Seeing this on AS7018 to AS1299. Anyone out there at either provider know anything about this? HOST: PC-002 Loss% Snt Last Avg Best Wrst StDev 1.|-- 172.31.255.1 0.0% 10 1 0.7 0 3 0.9 2.|-- 10.98.0.3 0.0% 10 1 1.0 1 1 0.0 3.|-- 67.51.253.17 0.0% 10 2 2.5 2 4 0.7 4.|-- 67.51.253.3 0.0% 10 1 1.2 1 2 0.4 5.|-- v202.core1.pdx1.he.net 0.0% 10 7 10.5 7 12 1.9 6.|-- 10ge12-4.core1.sea1.he.net 0.0% 10 5 5.0 5 5 0.0 7.|-- sea-b1-link.telia.net 0.0% 10 5 5.8 5 12 2.2 8.|-- den-b1-link.telia.net 0.0% 10 108 107.3 106 108 0.7 9.|-- sjo-b21-link.telia.net 20.0% 10 137 134.9 134 137 1.0 10.|-- 192.205.33.45 40.0% 10 136 136.2 135 138 1.2 11.|-- cr1.sffca.ip.att.net 10.0% 10 141 141.9 139 145 1.9 12.|-- 12.122.2.77 20.0% 10 140 140.1 137 142 2.0 13.|-- 12.122.160.149 10.0% 10 138 141.1 137 164 8.6 14.|-- 12.117.131.214 30.0% 10 139 141.0 139 145 1.9 15.|-- 199.103.47.2 30.0% 10 51 128.0 51 142 34.0 HOST: PC-002 Loss% Snt Last Avg Best Wrst StDev 1.|-- 172.31.255.1 0.0% 20 1 1.1 0 3 0.6 2.|-- 10.98.0.4 0.0% 20 1 1.3 1 4 0.7 3.|-- 67.51.253.17 0.0% 20 3 4.9 2 48 10.2 4.|-- 67.51.253.1 0.0% 20 2 1.1 1 2 0.3 5.|-- 67.51.253.11 0.0% 20 1 1.4 1 2 0.5 6.|-- v202.core1.pdx1.he.net 0.0% 20 6 9.1 1 12 3.2 7.|-- 10ge12-4.core1.sea1.he.net 0.0% 20 5 6.5 5 11 1.7 8.|-- sea-b1-link.telia.net 0.0% 20 5 5.1 5 6 0.3 9.|-- att-ic-153030-sea-b1.c.telia.net 0.0% 20 9 7.7 6 9 1.2 10.|-- cr83.st0wa.ip.att.net 5.0% 20 118 119.7 117 123 1.5 11.|-- cr2.ptdor.ip.att.net 0.0% 20 119 120.1 118 122 1.4 12.|-- cr2.sffca.ip.att.net 0.0% 20 120 119.2 117 121 1.4 13.|-- cr2.sc1ca.ip.att.net 0.0% 20 119 121.1 118 149 6.6 14.|-- 12.122.151.129 0.0% 20 118 119.8 117 122 1.5 15.|-- ??? 100.0% 20 0 0.0 0 0 0.0 16.|-- 71.157.120.39 75.0% 20 119 118.6 118 119 0.5 17.|-- 108-248-29-59.lightspeed.renonv.sbcglobal.net 5.0% 20 139 137.1 135 146 2.5 18.|-- 108-241-228-42.lightspeed.renonv.sbcglobal.net 5.0% 20 143 139.2 135 152 4.9 Attention: Information contained in this message and or attachments is intended only for the recipient(s) named above and may contain confidential and or privileged material that is protected under State or Federal law. If you are not the intended recipient, any disclosure, copying, distribution or action taken on it is prohibited. If you believe you have received this email in error, please contact the sender, delete this email and destroy all copies.

3 3

Spamhaus BGP feed experiences?
by Mike Lyon 20 May '15

20 May '15

Howdy! Any ISPs out there (big or small) ever used the Spamhaus BGP feed to prevent against botnet, spam, etc? If so, how has your experience been? Is it worthwhile? Has it helped? On / off list responses are appreciated in advance. Thank You, Mike -- Mike Lyon 408-621-4826 mike.lyon(a)gmail.com http://www.linkedin.com/in/mlyon

6 5

Re: your mail
by Larry Sheldon 19 May '15

19 May '15

On 5/19/2015 15:37, Jared Mauch wrote: > Can someone fix the DMARC settings to something > more sensible? I've had to deal with this on the outages list > already and it's simple to have it work in a more predictable way for > users than injecting this text. > > > The best settings are Munge From, (dmarc_moderation_action) > as it will preserve the thread in a sensible way. I feel it's quite > damaging to keep injecting this into the thread. One should also clear > the dmarc_wrapped_message_text setting. Blank subject lines get routed to the spam sump here. As a matter of policy, I do not open unexpected attachments, and strong suggest that opening an unexpected attachment may be the most dangerous thing you can do with an email reader is some environments. -- sed quis custodiet ipsos custodes? (Juvenal)

1 0

Re: your mail
by Jared Mauch 19 May '15

19 May '15

On Tue, May 19, 2015 at 03:53:19PM +0000, Ryan Shea via NANOG wrote: > This post was from a subscriber whose From: address domain has a DMARC > policy of reject or quarantine. The NANOG mailing list has > automatically wrapped this message to prevent other subscribers mail > systems from rejecting it. Can someone fix the DMARC settings to something more sensible? I've had to deal with this on the outages list already and it's simple to have it work in a more predictable way for users than injecting this text. The best settings are Munge From, (dmarc_moderation_action) as it will preserve the thread in a sensible way. I feel it's quite damaging to keep injecting this into the thread. One should also clear the dmarc_wrapped_message_text setting. - Jared -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

1 0

Re:
by Christopher Morrow 19 May '15

19 May '15

(-direct-ryan) yikes formatting for this got wonky... On Tue, May 19, 2015 at 11:53 AM, Ryan Shea via NANOG <nanog(a)nanog.org> > ---------- Forwarded message ---------- > From: Ryan Shea <ryanshea(a)google.com> > To: nanog list <nanog(a)nanog.org> > Cc: > Date: Tue, 19 May 2015 15:53:15 +0000 > Subject: Unified Security Vulnerability Management > > Manually setting up and parsing email notifications for security > vulnerabilities for all vendors is mighty annoying. It looks like the ICASI > CVRF <http://www.icasi.org/cvrf> Working Group thought the same thing back > in 2011 when they came up with this handy XML schema. I had not known of > this until yesterday and noticed that Cisco does a good job > <http://tools.cisco.com/security/center/cvrfListing.x> posting their > vulnerabilities in CVRF. Word on the streets is that Juniper > <https://twitter.com/junipersirt/status/70627418737610752> was at least > partially involved in CVRF as well. Brocade may have looked into it as well. > > This does not seem like a difficult thing for vendors to do, but the > missing piece may be customer interest. I am hoping to drum up some > interest here -- maybe a few support requests would entice them to hand > this off to an intern and we could collectively do better at managing > vendor notifications. A tool <https://github.com/mschiffm/cvrfparse> to > parse CVRF is already floating about as well (mschiffm). I bet if we can get FR/PR numbers for some vendors we might be able to get a bunch of people to add support through a central set of points per vendor. Can we put the PR for juniper here? (and if other folk have a PR/FR for their pet vendor(s) add those to the list?)

1 0

Unified Security Vulnerability Management
by Ryan Shea 19 May '15

19 May '15

Manually setting up and parsing email notifications for security vulnerabilities for all vendors is mighty annoying. It looks like the ICASI CVRF <http://www.icasi.org/cvrf> Working Group thought the same thing back in 2011 when they came up with this handy XML schema. I had not known of this until yesterday and noticed that Cisco does a good job <http://tools.cisco.com/security/center/cvrfListing.x> posting their vulnerabilities in CVRF. Word on the streets is that Juniper <https://twitter.com/junipersirt/status/70627418737610752> was at least partially involved in CVRF as well. Brocade may have looked into it as well. This does not seem like a difficult thing for vendors to do, but the missing piece may be customer interest. I am hoping to drum up some interest here -- maybe a few support requests would entice them to hand this off to an intern and we could collectively do better at managing vendor notifications. A tool <https://github.com/mschiffm/cvrfparse> to parse CVRF is already floating about as well (mschiffm).

1 0

A Canonical answer requested (AS41231)
by Christopher Morrow 19 May '15

19 May '15

if there's a canonical neteng/ops person around it'd be handy to get a contact off-list :) I have a question to ask... about bgp and paths and fun stuff such as that! (probably a traceroute or 'show ip bgp' would suffice from their perspective) -chris

2 3

Usage of Teredo and IPv6 for P2P on Windows 10 and Xbox One
by Darrin Veit 18 May '15

18 May '15

Hi Everyone - We've had very fruitful discussions with members of this community on Xbox One networking behavior, in particular concerning P2P multiplayer gaming activity. In an effort to continue that useful dialogue, we wanted to provide an informational update for Xbox One, but also share relevant details on upcoming Windows functionality in terms of Teredo and IPv6 usage. We also include some observations about IPv4 and IPv6 health that may be broadly interesting, especially as it pertains to network readiness for Xbox multiplayer via IPv6. New Xbox experiences launching on Windows 10 will use Teredo for P2P communications -------------------- Earlier this year we announced some Xbox functionality coming to Windows 10. One key feature of Windows 10 is enabling multiplayer gaming and chat functionality between Xbox One consoles and Windows 10 devices. This functionality on Windows 10 will behave similarly to how multiplayer works today on Xbox One, using Teredo for NAT traversal and IPsec for security. When used for Xbox Live enabled experiences, the Windows 10 Teredo client will prefer originating traffic from the IANA-registered port, 3074, when available. More detailed guidance on Xbox One behavior is linked at the bottom of this email. It also should be noted that Windows supports a broad range of applications and a huge portfolio of great games outside of the Xbox Live ecosystem. In general, Microsoft encourages broad adoption of the recommendations in RFC 4787, RFC 6092, and RFC 6888 to maximize the viability of P2P technologies for all. IPv4's P2P health is degrading -------------------- Qualitative and quantitative evidence available to us indicates that overall availability of functioning P2P connectivity on the IPv4 Internet is decreasing over time. In particular we are concerned that IPv4 address scarcity is forcing many small and medium market network operators to deploy carrier-grade NAT functionality. This often results in end-users being intractably stuck behind "strict" networks with degraded multiplayer experiences as a result. Healthy, standards-compliant IPv6 access is broadly needed, sooner rather than later. However, we have identified a few areas of concern in regard to IPv6 support that will hinder the efficacy of enabling multiplayer on IPv6. IPv6 is being deployed, but not perfectly, jeopardizing IPv6 P2P --------------------- Across the Xbox One customer base, in particular for customers who play multiplayer games, we observe that a substantial minority (around 20%) of devices have native IPv6 configured. This represents a much higher IPv6 penetration rate than Microsoft's other products and services report, as well as public data from other sources. However we have numerous concerns about IPv6's growth. We are often finding that retail customer premise equipment is configured with IPv6 disabled by default, requiring user action to enable. We've also encountered a very small set of reports where IPv6 latency and bandwidth performance are suboptimal compared to IPv4. Reports of this nature have usually focused on streaming media experiences and user concern that IPv6 is slower than IPv4 (i.e. "I get 1080P resolution with IPv4, and 720P with IPv6"). In the rare cases where these reports have been substantiated, the primary culprit has been differences in deployed CDN support. Also, some networking hardware and operators apply firewall policy to the IPv6 path contrary to RFC 6092 recommendations. Of particular concern are configurations where unsolicited inbound IKE/IPsec traffic is not permitted in the default operating mode. Growth of these non-conformant configurations puts the P2P benefit of the next generation Internet in jeopardy. It would be incredibly regrettable if IPv6 necessitated the high level of configuration and inefficiency currently required for IPv4. Deprecating public Teredo servers for Windows Vista and Windows 7 -------------------- On May 4th, 2015, we began deactivating Microsoft's publicly available Teredo servers currently configured as the default servers for Windows Vista and Windows 7 clients. This is a result of limited usage on those platforms and our desire to focus our operations on Xbox One and Windows 10. If you read this far, you are awesome. We will likely request a NANOG presentation slot later in the year to discuss these points, but we want to make sure we have sufficiently interesting and new things to discuss before swallowing up people's time. Network operators and CPE manufactures are encouraged to reach out to our team at xboxteredo(a)microsoft.com with operational questions. Please note that our most common reply will be "better documentation is coming later in the year," but we will try our best to respond to questions quickly. Thanks for your time, Darrin Veit & Christopher Palmer Xbox Platform Networking Operating System Group Current Xbox One Multiplayer Networking Guidance ------------------------- http://download.microsoft.com/download/A/C/4/AC4484B8-AA16-446F-86F8-BDFC49…

3 2